Adobe Commerce CVE-2026-48356

Exploitation requires the Adobe Commerce/Magento file-upload functionality (or the Webhooks Plugin ≤1.20.0) to be reachable and requires user interaction: a victim must visit an attacker-crafted URL or interact with a compromised web page for the injected script to execute in their session (UI:R). Per the CVSS vector (PR:N) no attacker authentication is needed to stage the payload, so 'remote attackers' can initiate it, but the payoff - account/session takeover and elevated access - is scoped to whatever the victim's session holds, meaning the practical high-value target is an authenticated admin or customer. Limiting factors: the mandatory victim interaction (no fully unattended exploitation), the absence of any known active exploitation (SSVC Exploitation: none, not in KEV), and non-automatable exploitation (SSVC Automatable: no). The affected version must be at or below the listed patch levels (Adobe Commerce ≤2.4.9 branch patches, Magento Open Source ≤2.4.9 branch, B2B ≤1.5.3 branch, Webhooks Plugin ≤1.20.0).

Signals partially conflict and should be reconciled before prioritization. The CVSS 3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) is Critical and reflects unauthenticated network reach with low complexity and a scope change, but it is tempered by required user interaction (UI:R) and zero availability impact (A:N), which is atypical for true server RCE and reinforces that the real impact is victim-session compromise. EPSS is high at 28.32% (98th percentile), yet CISA SSVC records Exploitation: none and Automatable: no, and the flaw is not in CISA KEV - so there is no evidence of active or automated mass exploitation despite the elevated statistical probability. Technical Impact is rated 'total' by SSVC. Net assessment: a genuine high priority for internet-facing Adobe Commerce/Magento storefronts given the platform's attacker interest and high EPSS, but the UI:R requirement and lack of automation/known exploitation make it targeted-social-engineering risk rather than a wormable, spray-and-pray issue. Discrepancy to verify with vendor: the 'arbitrary code execution' language versus metrics that describe browser-context script injection.

An attacker uploads a specially crafted file with a dangerous type to a vulnerable upload surface in an Adobe Commerce/Magento store, then lures an authenticated victim (e.g., an admin or customer) to a maliciously crafted URL or compromised page. When the victim's browser renders the stored/served payload, the injected script executes in their session context, allowing the attacker to hijack the account or escalate access. No public exploit code has been identified, and the low attack complexity plus network vector make the technical step easy, but success hinges on the required victim interaction.